The –s Switch

The –s Switch
As with the –A and –a switches, the lowercase –s switch is similar to its uppercase sibling. The nbtstat –s command produces the same output as nbtstat –S except that it tries to resolve remote host IP addresses into host names, if possible. Figure 4.10 shows sample output from the nbtstat –s command. Note the similarities between Figure 4.10 and Figure 4.9.

FIGURE 4 . 1 0 Sample output of the nbtstat –s command

NOTE:

As you can do with the netstat command, you can place a number for an interval at the end of any nbtstat command to indicate that the command should execute once every so many seconds (as specified by the number) until youpress Ctrl+C.

Read More

The –S Switch

The –S Switch
You use the -S switch to display the NetBIOS sessions table, which lists all the NetBIOS sessions, incoming and outgoing, to and from the host where you issue the command. The –S switch displays
both workstation and server sessions but lists remote addresses by IP address only. 
     Figure 4.9 shows sample output of the nbtstat –S command. The NetBIOS name is displayed along with its hex ID. The state of each session is also shown. An entry in the In/Out column determines whether the connection has been initiated from the computer on which you are running nbtstat (outbound) or whether another computer has initiated the connection to this
computer (inbound). The numbers in the Input and Output columns indicate (in bytes) the amount of data transferred between this station and the station listed in that entry.

FIGURE 4 . 9 Sample output of the nbtstat –S command

Read More

The –R Switch

The –R Switch
The -R switch is the exception that proves the rule because it has nothing to do with the –r switch. Let’s say that you have a bad name in the NetBIOS name cache but the right name is in the
LMHOSTS file. The LMHOSTS file contains NetBIOS names of stations and their associated IP addresses. Also, the cache is consulted before the LMHOSTS file is. The problem here is that the bad address will be in the cache (until it expires). To purge the NetBIOS name table cache and reload the LMHOSTS file into memory, simply use the nbtstat command with the –R switch, like so:
nbtstat –R

Read More

The –r Switch

The –r Switch
This switch is probably the most commonly used switch when NetBIOS over TCP/IP (NBT) statistics are checked. The –r switch displays the statistics of how many NetBIOS names have been
resolved to TCP/IP addresses. Figure 4.8 shows sample output of the nbtstat –r command.
     As you can see, the statistics are divided into categories. The first category is NetBIOS Names Resolution and Registration Statistics, which shows how many names have been resolved or registered either by broadcasts on the local segment or by lookup from a WINS name server. The second category gives the NetBIOS unique and group names and their associated hex IDs that were resolved or registered. In Figure 4.8, the output shows that no WINS server is operating, so all NetBIOS names were resolved by broadcast only. This is evident from the lack of statistics of names resolved by a name server.

FIGURE 4 . 8 Sample output of the nbtstat –r command

NOTE:

The –r switch is useful in determining how a workstation is resolving NetBIOS names and whether WINS is configured correctly. If WINS is not configured correctly or is simply not being used, the numbers in the Resolved by Name Server and Registered by Name Server categories will always be zero.

Read More